Order of DNS resolvers or "exclusive" route adding in Mac OS X?

Question

I am working at a company where – due to several strange reasons – I have the following setup:

• Ethernet: is in a guest network and has access to the internet
• Wifi: is in a corporate network and has access to the intranet
• the adapter order is set, so that the ethernet is first
• route add is used to add the intranet routes I need (10.[4/6/1/39].x.x. etc.)

The problem now is that certain programs don't work, since they do not use IPs but named addresses. Consequently scutil --dns therefore has resolver #1 with external DNS servers, and then follows resolver #2 with the intranet DNS servers. (if I disconnect the cable and am in the Wifi corp only, the names are resolved just fine).

I thought of two possible solutions, but I don't know how to get them working:

• even though Wifi is the first adapter in order, I somehow switch the DNS resolver order so that intranet DNS is tried before internet DNS
• put the Wifi adapter in first place and then find an "excluding" route command, which does not say "send IP X over en0" but instead "send any IP not equal to X over en1"

Can somebody help me here?

Answer 1

Sounds like I have been working at the same company ;-)

Please find at the below link a Ruby script that you can adapt to do what Hennes describes as option 4), although it uses forwarding of DNS request instead of views. This should be easy to fix though. https://github.com/simonair/pubcode/blob/master/multihome_setup/multihome_setup.rb

This script will use sudo as needed.

Only use it if you understand exactly what it does.

It is best to create a new Location using System Preferences > Network before you start experimenting with this script because this will allow you to undo any changes by switching back to the known-good Location.

What it will do:

• Enumerate all network interfaces and identify the one connected to the corporate network and the one connected to the other network based on their DEFAULT GATEWAYs' IP address (not the address assigned to the interface itself)
• Configure the built-in BIND DNS server to handle requests for both the corporate network and the Internet and forward them by domain. For example, example.com will be forwarded to the corporate name servers, whereas example.net will be forwarded to the other name servers.
• Establish routing to a list of subnets through the corporate interface, the rest through the other network
• Optionally, it will also initiate a VPN connection if configured properly.

You need to adapt the script to suit your needs.

Be aware that you need to call the script again with the argument restore once you disconnect from the corporate network, as otherwise all DNS requests will land at your local name server and it will not be able to resolve them outside your corporate environment.

Answer 2

I am not sure this is a proper full answer, but putting it in multiple comments seems a kludge.

1) Quick workaround:

Add the intranet names to the host file. (It is in /private/etc/hosts). This works if you only need access to a few servers and it is relative easy to do. It also feels like a kludge and if the server IPs ever change you will need to manually update your hosts file.

2) Assuming the DNS server on the intranet also revolves names on the Internet you can use only that DNS server. I deem this unlikely since you explicitly mentioned that the guest network has Internet access and the other to the intranet. (Could be if the intranet has internet access but that is blocked via some firewall rules which do not block everything. E.g. not port 53).

3) Using both DNS servers (which is what you are trying to do) might not work.

I have no OS/X machine to test this on, but I recently learned the hard way that some operating systems do not query DNS servers in order, nor do they fall back to a secondary nameserver when the first one fails. Instead they seems to use the the listed nameservers at random.

The result of that would be:
(order Internet DNS, intranet DNS)
Query host on internet -> works.
Query host on intranet -> Fail look up via DNS server on internet, give up rather then try next.

I do not know if this is the case on OS/X and I have no mac to test it on.

4) Local nameserver

(In bold because I think this is the best solution).

OS/X ships with BIND and it seems easy to enable it. The keyword you want to look for in BIND is views